A method for dynamic desensitization of electronic data

Abstract

This invention relates to the field of data anonymization technology and provides a dynamic data anonymization method for electronic data, comprising the following steps: Calculating a query intent convergence score based on a received electronic data access request. In this invention, upon receiving an electronic data access request, the field range, filtering conditions, aggregation behavior, and join depth of the query statement are first analyzed, and a convergence score is calculated. The score directly maps to the granularity of field anonymization, ensuring that the degree of anonymization closely matches the query intent and avoiding excessive masking that could distort the results. Subsequently, external connectivity paths are traced based on quasi-identifiers and asset graphs. Information arbitrage risk is quantified according to multiplicative probability and sensitive value. If the risk exceeds the threshold, a cutoff command is immediately triggered, and high-risk fields are immediately isolated to prevent cross-domain assembly.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of desensitization processing, and particularly relates to a dynamic desensitization processing method for electronic data. BACKGROUND

[0002] The technical field of desensitization processing focuses on removing or converting identifiable information without affecting the usability of data, to ensure that data meets regulatory and privacy compliance requirements during development testing, data analysis, sharing and circulation, and cross-domain collaboration.

[0003] Most existing desensitization processing technologies use fixed rules to mask key fields during data storage or offline export, rely on pre-set mask templates and static permission lists, lack awareness of real-time query intent, lack tracking means for external information fusion paths, and are difficult to dynamically adjust the desensitization granularity according to the access context. When encountering complex connections and cross-table aggregation, due to the static rules taking effect according to the field dimension, the desensitization granularity is often too coarse, and the analysis value is limited; or in the scenario where the field is not covered, the desensitization vacancy leads to sensitive leakage. Lack of comprehensive measurement of the connection probability and sensitive value of external information sources, data sharing cannot accurately identify high-risk requests, often sacrificing business efficiency with a one-size-fits-all approach. SUMMARY

[0004] The purpose of the present application is to provide a hospital internal network security access method, which aims to solve the technical problems existing in the prior art identified in the background.

[0005] The present application is implemented as follows: a dynamic desensitization processing method for electronic data, the method comprising:

[0006] An electronic data access request is obtained, and a query intent convergence score is calculated. Specifically, by analyzing the access request, the number of filter fields, the number of logical operators, the frequency of aggregation function calls, the JOIN nesting level, the number of JOIN fields, the total number of target fields and the total number of filterable fields, etc. Characteristic parameters are extracted, and then normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity and field selection ratio are calculated, and query intent convergence score is generated by comprehensively considering these indicators to quantify the accuracy and pertinence of the access request.

[0007] The quasi-identifier to be queried is read from the electronic data access request, the data asset association graph is combined, and the association path connectable to the external information source is identified and tracked. By analyzing the field type pointed to by the quasi-identifier, all connectable nodes in the data asset association graph are traversed, the complete association path meeting the cross-source connection condition is located, and continuous operation is performed based on the connection probability value of each edge in the association path to generate a high-risk information association path list. On this basis, the structure of each association path is extracted, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level of the end entity and the sensitive information value level corresponding to the association target are extracted, and the information arbitrage risk assessment value is calculated by combining the connection success probability value, so that the risk of data leakage and information abuse is comprehensively evaluated.

[0008] Based on the query intention convergence score and the information arbitrage risk assessment value, a dynamic data access control rule is established. The query intention convergence score is compared with a preset score interval to determine the corresponding basic fuzzification level; the information arbitrage risk assessment value is compared with a preset risk threshold, the high-risk association path exceeding the threshold is marked, and an association cutting instruction is generated, and finally the basic fuzzification level, the association cutting instruction and the threshold-exceeding path marking set are packaged as the dynamic data access control rule.

[0009] The operation item in the dynamic data access control rule is analyzed, and the selected column and the connection condition in the electronic data access request are replaced based on the operation item mapping list - the selected column is directly replaced with a desensitization placeholder, and the desensitization function expression is embedded in the outer layer of the connection condition, to generate a query instruction after desensitization rewriting. The query instruction is submitted to the data platform for execution, and after receiving the query result, the data source and the processing level are marked according to the desensitization strategy to obtain and return an access-controlled desensitization data set.

[0010] The beneficial effects of the present application are:

[0011] Upon receiving the electronic data access request, the field range, filtering condition, aggregation behavior, and connection depth of the query statement are first parsed and the convergence score is calculated, the score is directly mapped to the field desensitization granularity, so that the desensitization degree closely follows the query intention, and the result distortion caused by excessive masking is avoided; then, the external communication path is tracked according to the quasi-identifier and asset graph, the arbitrage risk is quantified according to the connection probability and sensitive value, and the cutting instruction is triggered immediately when the risk exceeds the threshold, the high-risk field is isolated immediately, and the cross-domain assembly is blocked; the convergence degree and risk result drive the dynamic rule generation in two dimensions, and the selected column and connection condition are executed in real time to replace or functionally encapsulate the query rewriting, and the data platform executes the rewriting instruction to output the controlled result without copying the source data, which embeds the evaluation, decision, and execution closed loop in the query stage, can adjust the desensitization level in real time and implement precise blocking on potential arbitrage scenarios, while keeping the query delay at a very low level, supporting business continuous calling, security audit, and traceable playback three requirements, improving data utilization efficiency and privacy compliance strength. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 A step diagram of the dynamic desensitization processing method of electronic data provided by the embodiment of the present application. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0014] As shown in Figure 1 A dynamic desensitization processing method of electronic data, the method comprises:

[0015] S1, obtaining an electronic data access request, and calculating a query intention convergence score based on the electronic data access request;

[0016] The calculation of the query intention convergence score comprises the following steps:

[0017] The SQL query statement in the electronic data access request is parsed, the number of filtering fields and the number of logical operators in the WHERE clause are identified and counted, the frequency of aggregation function calls, the nesting level of JOIN operation and the number of connection fields used are counted, and the total number of fields and the total number of filterable fields in the target table are extracted in combination with the table structure information obtained from the metadata, forming the number of filtering fields, the number of logical operators, the frequency of aggregation function calls, the nesting level of JOIN, the number of JOIN fields, the total number of target fields, and the total number of filterable fields;

[0018] The filter field usage rate is calculated based on the number of filter fields and the total number of filterable fields, and the normalized WHERE clause complexity index is formed in combination with the number of logical operators, the JOIN structure complexity is constructed by calling the JOIN nesting level and the number of JOIN fields, the aggregation function call frequency is extracted as the aggregation usage intensity, the total number of fields and the number of selected column fields are extracted to calculate the field selection ratio, and the normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity and field selection ratio are generated;

[0019] According to the normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity and field selection ratio, the query intention convergence degree score is calculated:

[0020] ;

[0021] Wherein, is the query intention convergence degree score, is the normalized WHERE clause complexity, is the JOIN structure complexity, is the aggregation function call frequency, is the number of selected column fields in the query, is the total number of fields of the target table, is the number of filter fields in the WHERE clause, is the number of fields with filtering capability in the target table, is the number of logical operators, is the JOIN nesting level, is the number of connection fields used in JOIN, is the logical operation penalty factor, is the connection complexity growth factor, , , , are the adjustment coefficients of each structure factor respectively.

[0022] Specifically, the initial analysis work starts from the SQL query statement contained in the received electronic data access request, by introducing an abstract syntax tree (AST) parser, for example, using ANTLR (Another Tool for Language Recognition) and other tools according to the predefined SQL syntax rules, the pure text query instruction is converted into a hierarchical tree data structure, which reflects the logical composition of the original query, and the subsequent statistical and recognition work is carried out on this structured data:

[0023] Firstly, traverse the abstract syntax tree, locate the node corresponding to the WHERE clause, under this node, recursively count the number of end field nodes as filtering conditions, and record this count value as the number of filtering fields, at the same time, identify and accumulate the number of all logical connection word (such as AND, OR, NOT) nodes in the expression tree of this WHERE clause, get the number of logical operators;

[0024] Next, the parser moves to the SELECT list node to scan whether there is an aggregate function call, such as SUM, COUNT, AVG, MAX, MIN, etc., and accumulates the total number of calls as the frequency of aggregate function calls. For table join operations in the query, analyze the FROM clause node, determine the JOIN nesting level by checking the nesting depth of the JOIN node, a direct TableA JOIN TableB is counted as level 1, while (TableA JOIN TableB) JOIN TableC is counted as level 2, and in the ON condition expression of each JOIN, extract all fields used for connection, count the total number of unique fields as the number of JOIN fields.

[0025] To obtain the basic information of the table structure, the system will connect to the metadata information base (such as information_schema) of the data platform by executing an independent metadata query instruction, query and extract all the field list of the target table specified in the FROM clause of the SQL statement to calculate the total number of target fields, and at the same time, determine which fields have effective filtering function according to a clear filtering standard, which is defined as: any field that has an index established in the database (including B-Tree, Hash, etc.) or whose data type is numeric, date and time, or fixed-length string (such as VARCHAR(255) and below) is considered as a field with filtering ability. The number of such fields is counted to obtain the total number of filterable fields. For example, for a query SELECT dept_name, AVG(salary) FROM employee JOIN department ON employee.dept_id = department.id WHERE employee.status = 'active' AND employee.hire_date > '2022-01-01', the parser will identify the filter fields as status and hire_date, the logical operator as AND one, the aggregate function call as AVG once, the JOIN nesting level as 1, and the JOIN fields as dept_id and id. If the employee table has 8 fields, 6 of which (such as id, status, hire_date, salary, dept_id, manager_id) meet the above filtering ability definition, then the final filter field number is 2, the logical operator number is 1, the aggregate function call frequency is 1, the JOIN nesting level is 1, the JOIN field number is 2, the target field total number is 8, and the filterable field total number is 6.

[0026] Based on the filter field number, logical operator number, aggregate function call frequency, JOIN nesting level, JOIN field number, target field total number, and filterable field total number obtained in the previous stage, the system begins to build four core measurement indicators for the final score:

[0027] First, calculate the normalized WHERE clause complexity index. This process first divides the filter field number by the total number of filterable fields to obtain a basic filter field usage rate, which reflects the extent to which the query utilizes the available filtering conditions in the table.

[0028] Subsequently, to quantify the effect of logical operators on improving query accuracy, the number of logical operators was multiplied by a preset logical operation penalty factor, and the result was incremented by 1 and then multiplied by the usage rate of the filter field. This penalty factor was set based on the analysis of historical query logs, which showed that each additional AND or OR operator reduced the size of the query result set by an average of about 10%. Therefore, it was set to 0.1. The specific calculation formula is as follows: ,in For the number of filter fields, This represents the total number of filterable fields. For logical operators, Next, a logical operation penalty factor is used. Then, the JOIN structure complexity is constructed. This metric is based on the JOIN nesting level and amplifies the impact of the number of join fields through a join complexity growth factor. This growth factor is also based on experience. Considering that multi-field joins usually mean more complex entity relationships, its value is set to 0.2. The calculation method is the sum of the JOIN nesting level multiplied by 1 and the product of the number of JOIN fields and the growth factor. Then, the frequency of aggregate function calls is directly used as an aggregate usage intensity indicator. This value does not need further calculation and directly reflects the degree to which the query summarizes and analyzes the data.

[0029] Finally, the field selection ratio is calculated. By parsing the SELECT clause in the original SQL statement, the number of selected columns returned by the query is counted, and this number is divided by the total number of fields in the target table to obtain a ratio between 0 and 1. This ratio measures the degree of divergence of the query intent. The more fields returned, the more divergent the intent. For example, using the previous calculation results: number of filtered fields 2, number of logical operators 1, frequency of aggregate function calls 1, JOIN nesting level 1, number of JOIN fields 2, total number of target fields 8, total number of filterable fields 6, and counting the number of selected columns as 2 (dept_name and AVG(salary)), the normalized WHERE clause complexity is calculated to be (2 / 6)*(1+0.1*1)=0.367, the JOIN structure complexity is 1*(1+0.2*2)=1.4, the aggregation usage intensity is 1, and the field selection ratio is 2 / 8=0.25. Finally, these four indicator values ​​are generated and passed to the subsequent scoring steps.

[0030] For the formula used to calculate the query intent convergence score, the numerator of the formula... The goal is to measure the "precision" and "complexity" of a query. A more precise and complex query usually means that the user has a more specific goal, and therefore its intent convergence is higher. This is achieved by introducing a normalized WHERE clause to measure complexity. JOIN structure complexity Together, they evaluated the granularity of query filtering and the complexity of associations, while the aggregation used intensity. Logarithmic processing This demonstrates that the contribution of aggregation operations to the intended convergence exhibits diminishing marginal returns. The denominator of the formula... This serves as a penalty to suppress "divergent" queries, applied when the number of fields selected in the query... Percentage of total fields When the proportion is high, the exponential function This will cause the denominator to increase dramatically, thereby reducing the final convergence score. This effectively identifies and punishes "data breach" queries with unclear intentions that attempt to obtain large amounts of data. (Each adjustment coefficient...) , , , The introduction of this feature makes the model highly configurable, allowing it to be flexibly adjusted according to different data environments and security strategies, thereby achieving the best balance between ensuring data security and data utilization efficiency.

[0031] To normalize the complexity of the WHERE clause, this parameter is calculated using the steps described above, and its calculation formula is as follows: This parameter measures the effectiveness and logical rigor of a query's use of filtering conditions. It combines the breadth of the filtering fields used (the proportion of all filterable fields used) and the depth of logic (the number of logical operators used). A high value... This means that the query statement limits the result set through multiple precise conditions, making its target very clear. In the example, based on the calculations in the preceding steps, its value is 0.367.

[0032] The JOIN structure complexity is also calculated using the aforementioned steps, and its formula is as follows: This parameter is used to quantify the complexity of table join operations in a query. It considers not only the depth of the join (nesting level) but also... ), and also by the number of join fields This is used to assess the complexity of the association. In data association analysis, complex JOIN operations often indicate that users are attempting to locate very specific data entities by piecing together information from multiple dimensions, thus serving as an important indicator of query intent convergence. In the example, based on the calculations of the preceding steps, its value is 1.4.

[0033] This parameter represents the frequency of aggregate function calls. It is obtained by directly counting the number of aggregate functions such as COUNT, SUM, and AVG in SQL queries. Aggregation operations represent the user's intention to statistically summarize and generalize data, rather than requesting raw detailed data. High-frequency aggregation is usually associated with analytical and reporting queries, which have relatively convergent intents and lower risks. In the example, this value is 1.

[0034] The number of columns selected in the query is calculated by parsing the SELECT clause of the SQL statement and counting the number of columns included in the final output. This parameter is directly related to the breadth of data exposure. The more columns selected, the more information a single query reveals, and the more diversified the query intent becomes. In the example, this value is 2.

[0035] The total number of fields in the target table. This parameter, obtained from the data dictionary or metadata, represents the total number of attributes contained in the queried parent table. It serves as the benchmark for calculating the field selectivity ratio and is used to... The absolute quantity is converted into a relative proportion, thus enabling comparable evaluation between queries across different tables. In the example, this value is 8.

[0036] , , , These are the adjustment coefficients for each structural factor. These coefficients are not fixed values, but are derived through machine learning regression training on a standardized query sample database. The specific setting process is as follows:

[0037] First, a team of data security experts manually reviewed 500 representative historical query logs. Based on the business background, complexity, and degree of sensitive data involved in each query, they manually scored the "query intent convergence" with a score range of 0-10, forming a benchmark dataset.

[0038] Then, the structured parameters of these 500 queries ( , , , Using expert ratings as the target value and taking them as the input features, a gradient boosting decision tree model is used for training. The optimal coefficients are automatically learned and determined by optimizing the loss function.

[0039] For example, after training, the model found that the constraints of the WHERE clause have the greatest impact on the convergence of intent, while the impact of the aggregation function is relatively small. This resulted in a set of adjustment coefficients, such as the WHERE clause complexity adjustment coefficient. Set to 2.8, the complexity adjustment factor for JOIN structures. Set to 1.2, polymerization strength adjustment factor Set to 0.5, and select the penalty adjustment coefficient as the field. Set it to 3.5.

[0040] Example 1:

[0041] Based on the calculation results from the preceding steps, the values ​​of each parameter are as follows:

[0042] Normalized WHERE clause complexity ; JOIN structure complexity Aggregate function call frequency The number of fields selected in the query. Total number of fields in the target table The adjustment coefficients for each structural factor are: , , , .

[0043] Substitute the above parameter values ​​into the query intent convergence scoring formula:

[0044] ;

[0045] The result indicates that the query intent convergence score for this SQL query is 1.4689. This value is a dimensionless comprehensive score used to quantify the risk level and target clarity of the query request. The system pre-defines a mapping rule between score ranges and risk levels. For example, scores between 0 and 2 are defined as "high risk / low convergence," between 2 and 5 as "medium risk / moderate convergence," and above 5 as "low risk / high convergence." The calculated score of 1.4689 falls within the "high risk / low convergence" range, sending a clear signal to the data security system: the query intent is relatively diffuse and may pose a potential risk of data leakage. Therefore, subsequent data access control strategies will be based on this score, selecting a relatively strict basic obfuscation level, such as performing intensive desensitization processing on some fields in the returned results, like complete masking or type-preserving formatting masks.

[0046] S2. Read the quasi-identifier to be queried from the electronic data access request, and combine it with the data asset association map to identify and track the association paths that can be connected to external information sources, calculate the connection success probability of each association path, generate a list of high-risk information association paths, and obtain the information arbitrage risk assessment value by combining the preset sensitive information value.

[0047] 1. The specific steps for generating the list of high-risk information association paths are as follows:

[0048] Read the quasi-identifier to be queried from the electronic data access request, and parse the field type pointed to by the quasi-identifier based on the set of quasi-identifiers to be queried;

[0049] Traverse all connectable nodes in the data asset association graph, locate all complete association paths that meet the cross-source connection conditions, and perform continuous calculations based on the connection probability value corresponding to each edge in the association path to generate a list of high-risk information association paths.

[0050] Example 2:

[0051] Based on the set of quasi-identifiers to be queried extracted from the initial electronic data access request, such as fields containing "name" and "company email", the system startup path discovery process is as follows:

[0052] First, metadata parsing clarifies that "Name" is a string type and "Company Email" is a string type conforming to a specific format. These are then used as the starting nodes for graph traversal. This graph is a pre-constructed data asset association graph, a directed weighted graph where nodes represent specific fields in all data assets within the enterprise (e.g., db1.user.name), edges represent the relationships between fields, and the edge weight is the join probability value. This probability value is determined according to a hierarchical rule: if there is a foreign key constraint between two fields, the join probability value is 1.0; otherwise... For fields without foreign keys but with identical names and data types (e.g., order.user_id and log.user_id), the probability is 0.95. For fields whose names match a thesaurus (a dictionary maintained by data governance experts that includes entries such as "telephone," "mobile phone," and "contact information") and whose data types are compatible, the probability is 0.85. For fields whose content has a Jaccard similarity calculated from sampled data that exceeds 0.8 (this threshold is set by analyzing the data distribution of historical successful association cases and taking the 80th percentile), the probability is 0.8.

[0053] The traversal process employs a depth-first search algorithm, starting from the "Name" and "Company Email" nodes and exploring along the edges of the graph. Each time a path extends from a node in one data source (such as CRM_DB) to a node in another data source (such as HR_System_DB), it is considered a cross-source connection. The algorithm continues to explore until the path reaches a terminal node marked as "highly sensitive" (such as HR_System_DB.employee.id_card_number) or the path length exceeds a preset upper limit of 10 layers. This upper limit is set to prevent infinite loops and control computational overhead, and is determined based on statistical analysis of the average path length of the graph. During the traversal, the total success probability of each complete path (from the starting point to the highly sensitive endpoint) is obtained by multiplying the connection probabilities of all edges on the path. For example, if a path passes through three edges with probabilities of 0.95, 0.85, and 1.0 respectively, then the total success probability of the path is 0.8075.

[0054] Finally, all paths with a total connection success probability exceeding 0.7 are filtered out to form a list of high-risk information association paths. This 0.7 threshold is set according to a risk acceptance strategy, aiming to balance business query needs with data security. It represents the risk level at which attackers have a high probability of successfully associating information.

[0055] 2. The specific steps for obtaining the information arbitrage risk assessment value are as follows:

[0056] Based on the list of high-risk information association paths, structural extraction is performed on each association path. The number of field co-occurrence pairs, the number of cross-domain jumps, and the structural integrity level of the endpoint entity in the association path are extracted, as well as the sensitive information value level corresponding to the associated target of the association path. The connection success probability value, number of field co-occurrence pairs, number of cross-domain jumps, structural integrity level, and sensitive information value level of each association path are generated.

[0057] Based on the success probability of each associated path, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level, and the sensitivity value level, calculate the information arbitrage risk assessment value:

[0058] ;

[0059] in, This is the risk assessment value for information arbitrage. This represents the probability of a successful connection on the h-th path (obtained by multiplying the connection probabilities of all edges within the path). This indicates the value level of the sensitive information associated with the h-th path (e.g., ID number is 10, mobile phone number is 5). This indicates the structural integrity level of the entity at the end of the h-th path. This indicates the number of field co-occurrence pairs in the h-th path. This represents the number of cross-domain redirects in the h-th path. This is an exponential factor for the complexity of cross-domain jumps. This is the cross-domain risk growth ratio coefficient. This represents the total number of reachable paths.

[0060] Example 3:

[0061] Based on the list of high-risk information association paths generated in the previous step, the system performs detailed structured feature extraction on each path in the list:

[0062] First, to extract the number of co-occurrence pairs of fields, the system analyzes each data table or entity node traversed by the path. Within each node, it identifies and counts all pairs of quasi-identifiers or sensitive information fields. For example, if a path passes through the customer_info table, which contains both "phone number" and "home address" fields, it is counted as one co-occurrence pair. If it subsequently passes through the transaction_log table, which contains "transaction amount" and "credit card number", another co-occurrence pair is added. Finally, the number of co-occurrence pairs on the entire path is summed to obtain the number of field co-occurrence pairs for that path.

[0063] Secondly, to extract the number of cross-domain jumps, the system checks the attributes of each edge in the path. These edges have been marked as crossing predefined "data domains" when the graph is constructed. The criteria for dividing data domains are based on the system's physical deployment (such as different database instances), business affiliation (such as sales domain, financial domain), or security level (such as core area, non-core area). Whenever the path moves from a node in one domain to a node in another different domain, the number of cross-domain jumps is incremented by one.

[0064] Next, the system evaluates the structural integrity level of the path endpoint entity, which is calculated using a quantitative formula: Where N is the total number of all possible associated attributes under this entity type. It is the i-th attribute. It is an indicator function that indicates whether the path can be successfully associated with the attribute. The value is 1 if it is 1, otherwise it is 0. This is the importance weight of attribute i, which is assessed by the Data Governance Committee based on the business value and sensitivity of the attribute (e.g., a weight of 1.0 for core identifiers and 0.5 for auxiliary information). The value is then mapped to a level from 1 to 5 according to a preset range. For example, 0-0.2 is level 1, 0.2-0.4 is level 2, and so on.

[0065] Finally, the value level of sensitive information corresponding to the path-related targets is extracted. This operation is completed by querying a pre-set sensitive information classification and grading table. This table is formulated by the information security department based on national standards and industry regulations (such as GDPR and the Personal Information Protection Act), which clearly defines the value level of various types of sensitive information (such as ID card numbers, mobile phone numbers, and medical records). For example, ID card numbers are level 10 and mobile phone numbers are level 5. After completing all the above extractions, the system encapsulates the original connection success probability value of each path, the calculated number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level, and the value level of the retrieved sensitive information into a structured record, and finally generates a set containing all high-risk paths and their complete feature parameters.

[0066] The advantage of the formula for calculating the risk assessment value of information arbitrage lies in its ability to identify the highest-risk path from numerous potential data breaches, thus enabling precise risk quantification. Instead of simply adding up the various risk factors, the formula uses multiplication and non-linear functions to more accurately reflect the combined effect of risks.

[0067] The base risk value is determined by the probability of successful path connection. Value of sensitive information and information completeness The product of these three factors illustrates that risk is the product of "possibility" and "harm." Only when a path is easily paved and the information it points to is highly valuable and complete will the underlying risk be high. Furthermore, the formula... This item introduces considerations regarding "attack complexity". The study used a logarithmic function to capture the risk increase resulting from field co-occurrence, demonstrating the marginal effect that while more information dimensions lead to increased risk, the rate of increase slows down. The term, through an exponential function, significantly amplifies the risks associated with cross-domain jumps, accurately depicting the technical difficulty and dramatically increased risks of data association between different systems. Finally, The operation ensured that the final evaluation result reflected the "worst-case scenario," that is, the maximum potential risk that the entire query request could cause, providing the most critical and direct basis for subsequent access control decisions.

[0068] The total number of reachable paths refers to the sum of all paths in the data asset association graph that can successfully connect to any sensitive information node starting from the quasi-identifier to be queried. This value is directly obtained from the path traversal steps described above. For example, if three paths satisfying the conditions are found after one traversal, then... .

[0069] This parameter represents the probability of a successful connection along the h-th path. It measures the likelihood that an attacker can successfully link to sensitive target information along a specific path. It is obtained by multiplying the connection probabilities of all edges along the path. These probabilities are determined in previous steps based on rules such as foreign keys, field name / type matching, and content similarity. A typical example is: a path sequentially connects user.id with order.user_id (foreign key connection, probability 1.0), order.address_id with address.id (similar names and matching types, probability 0.95), and address.zipcode with external credit data credit.zip (content similarity 0.88). The probability of this path being successful is... .

[0070] This indicates the value level of sensitive information associated with the h-th path. This is a quantitative indicator reflecting the potential harm caused by the potential leakage of sensitive data pointed to by the path's endpoint. This level is predefined in a static configuration table by the data governance and information security team based on legal and regulatory requirements, business impact, and remediation costs. For example, the following standards could be set: ID card number and bank card number are level 10; mobile phone number and precise address are level 8; email address and workplace are level 5; user profile tags are level 3. When the endpoint of a path is the employee.id_card_number field, its... The value is 10.

[0071] This represents the structural integrity level of the entity at the end of the h-th path. It assesses the richness of information about the target entity that can be obtained through this path. This level is calculated by weighted summation of all possible attributes of the entity and then mapped to a scale of 1-5. The calculation formula is: Where N is the total number of attributes of the entity. For the i-th attribute, For attribute weights, A value of 1 or 0 indicates whether the item can be retrieved. For example, a "Customer" entity has 5 attributes: Name ,cell phone ,address ,Mail Registration time If a path can be linked to a name, phone number, and address, then... The total weight is 3.6. According to the grading standards (e.g., 0.6-0.8 corresponds to level 4), then .

[0072] This parameter represents the number of co-occurrence pairs of fields appearing in the h-th path. It reflects how many quasi-identifiers or sensitive information are "captured" from the same data source during the association process, increasing the dimension of information exposure. It is obtained by checking each data table visited during path traversal and calculating the number of pairs of quasi-identifiers and sensitive fields within that table. For example, if the path passes through the `user_profile` table, which has three quasi-identifiers: `name`, `phone`, and `email`, then there are three co-occurrence pairs: (name, phone), (name, email), and (phone, email). The h-th path... The contribution value is 3.

[0073] This represents the number of cross-domain jumps in the h-th path. This parameter quantifies the complexity and technical threshold of information association; the more system boundaries crossed, the higher the risk. Data domains are divided based on business systems, database instances, or network security domains. In the graph, each edge crossing different domains is marked. The path planning algorithm accumulates the number of these marked edges during traversal to obtain the path. For example, if the path goes from the `customer` table in the CRM database to the `order` table in the ERP database, and then to the `user_log` table in the big data platform, then... .

[0074] This is the cross-domain jump complexity exponential factor, an empirical parameter used to simulate the exponential growth of risk when data is linked across systems. Its setting is based on the analysis of multiple known data breach incidents, statistically showing the multiplier by which an attacker's ability to obtain core data increases for each additional system boundary breached. Analysis of 50 historical major data breach cases revealed that the median multiplier of this capability increase is approximately 1.6, therefore, this factor is set... .

[0075] This is the cross-domain risk growth coefficient, used to balance the relative importance of field co-occurrence risk and cross-domain jump risk in the total risk calculation. It is set using the Analytic Hierarchy Process (AHP), inviting five senior data security experts to conduct pairwise comparisons and scores on which contributes more to the final information arbitrage risk: "multi-field co-occurrence" or "cross-domain jump." A judgment matrix is ​​constructed, the largest eigenvalue and corresponding eigenvector of the matrix are calculated, and a consistency check is performed. The final calculated weight vector is (0.3, 0.7), therefore, the adjustment coefficient for cross-domain risk is set to... Take another value here. .

[0076] Calculation process:

[0077] In this example, the preliminary steps identified two high-risk paths. .

[0078] Path 1: Points to ID card number, connection success probability Sensitive information value level. ,

[0079] Structural integrity level Count of co-occurrence pairs of the field Cross-domain redirection count .

[0080] Path 2: Points to bank card number, connection success probability Sensitive information value level ,

[0081] Structural integrity level Count of co-occurrence pairs of the field Cross-domain redirection count .

[0082] Adjustment coefficient , .

[0083] Calculate the risk value of path 1 :

[0084] ;

[0085] Calculate the risk value of path 2 :

[0086] ;

[0087] Compare the risk values ​​of the two paths and take the higher value as the final information arbitrage risk assessment value. :

[0088] ;

[0089] The result indicates that the maximum information arbitrage risk assessment value triggered by this data access request is 48.2706. This value comprehensively reflects the overall risk level of an attacker successfully obtaining high-value, relatively complete sensitive information (bank card number) through this query via the most dangerous association path (path 2). The system sets a risk threshold, such as 30. This threshold is set based on an assessment of the organization's risk tolerance and is approved by the CISO (Chief Information Security Officer). Risks below this threshold are considered acceptable. Since the currently calculated risk value of 48.2706 is much greater than 30, it indicates that this query request has an unacceptably high risk. Therefore, the system must take strong intervention measures, such as specifically cutting off the association of the highest-risk path 2 (i.e., the path that spans two data fields and ultimately points to the bank card number) in subsequent steps to eliminate this primary source of risk.

[0090] S3. Compare the query intent convergence score with the preset score range, select the corresponding basic fuzziness level, and at the same time determine the information arbitrage risk assessment value with the preset risk threshold to establish dynamic data access control rules.

[0091] 1. The specific steps for establishing dynamic data access control rules are as follows:

[0092] The query intent convergence score is called, and compared with the score interval boundary set in the configuration table. The query intent convergence score is compared with the upper limit of each score interval one by one. When the query intent convergence score is less than or equal to the upper limit of any score interval and greater than the upper limit of the previous score interval, the score interval mapping index is locked. Then, the corresponding entry is retrieved in the fuzziness level mapping table using the mapping index to generate the basic fuzziness level.

[0093] Based on the aforementioned basic fuzziness level, the risk threshold is read, and the information arbitrage risk assessment value is compared with the risk threshold. If the information arbitrage risk assessment value is greater than the risk threshold, the list of high-risk information association paths is traversed in sequence, and each association path is marked with an over-threshold tag to generate an over-threshold path tag set.

[0094] Based on the set of super-threshold path markers, the quasi-identifier field in each super-threshold path is parsed, and an association cutoff instruction is constructed according to the concatenation rule of the quasi-identifier field and the unique identifier of the data asset. The basic fuzziness level, the association cutoff instruction and the set of super-threshold path markers are encapsulated into a unified policy structure to form dynamic data access control rules.

[0095] Example 4:

[0096] The system invokes the query intent convergence score calculated in the preceding steps. This score is a floating-point value, for example, 1.4689. The system then initiates a level mapping process. This process first accesses an internal configuration table, which establishes the correspondence between the score range boundary set and the fuzziness level. This configuration table is built based on statistical analysis of over ten thousand historical query logs. Data security experts categorized these queries into four types according to their nature and potential risk (e.g., high-risk exploratory queries, medium-risk analytical queries, low-risk business queries, etc.). The system calculates the convergence score distribution of query intent for each type of query (including service-oriented queries and risk-free routine queries), and takes the 75th, 50th, and 25th percentiles of the distribution as the boundary values ​​of the intervals. For example, the final set of score interval boundaries is [2.0, 5.0, 8.0]. These three values ​​divide the score range into four intervals: (negative infinity, 2.0], (2.0, 5.0], (5.0, 8.0], and (8.0, positive infinity). Each interval is assigned a sequential index starting from 1.

[0097] Next, the system performs a loop comparison operation, comparing the input score of 1.4689 with the upper limit values ​​[2.0, 5.0, 8.0] in the boundary set from left to right. In the first comparison, it is found that 1.4689 is less than or equal to 2.0, and it is also greater than the upper limit of the previous interval (implied negative infinity in this example). The condition is met, so the mapping index of the current interval is locked to 1, and subsequent comparisons are immediately stopped. Then, the system uses this locked mapping index 1 to perform a search in a static fuzzy level mapping table, which defines in detail the specific values ​​corresponding to each index. The desensitization level is defined by the data governance strategy, for example: {1: "High-intensity blurring", 2: "Medium-intensity blurring", 3: "Low-intensity blurring", 4: "No blurring"}. "High-intensity blurring" corresponds to replacing sensitive fields with a fixed mask "********", "Medium-intensity blurring" corresponds to retaining the prefix and suffix mask, and "Low-intensity blurring" may be a data type conversion. By querying this table with index 1, the system retrieves the corresponding entry "High-intensity blurring" and finally outputs this string as the result to generate the basic blurring level.

[0098] Based on the basic obfuscation level generated in the previous step, such as "high-intensity obfuscation", the system then reads a globally configured risk threshold constant. This threshold, for example, is set to 30. The value is not arbitrarily assigned, but rather derived from the organization's risk tolerance statement. By quantitatively analyzing the potential financial losses, brand reputation damage, and legal compliance penalties that may be caused by a data breach, and combining the organization's business strategy and risk appetite, an acceptable maximum risk exposure value is finally determined and solidified into a system constant. This value is reviewed every six months.

[0099] Subsequently, the system directly compares the information arbitrage risk assessment value calculated in the previous steps, for example, 48.2706, with the risk threshold of 30. Since 48.2706 is greater than 30, the result is considered true, and this result immediately triggers the path filtering process. The goal of this process is to accurately locate the specific risk source path that causes the overall risk to exceed the limit. After the process is started, the system will sequentially traverse the previously generated list of high-risk information association paths. For each path in the list, the system will recalculate its independent risk assessment value (this value was already obtained when calculating the maximum value of the information arbitrage risk assessment value). For example, the risk value of path 1 is 44.352 and the risk value of path 2 is 48.2706. Then, the independent risk value of each path is compared with the risk threshold of 30 again. For path 1, since 44.352 is greater than 30, the system adds a boolean flag is_over_threshold=true to the data structure of this path. For path 2, since 48.2706 is also greater than 30, the same over-threshold flag is added to it. After traversal, the system collects all paths marked with the over-threshold flag to form an over-threshold path flag set.

[0100] Based on the threshold-exceeding path tag set generated in the previous process, which contains information on all individual paths whose risk values ​​exceed the threshold, the system begins to construct the final dynamic access control policy:

[0101] First, the system performs a deep analysis on each out-of-threshold path in the set, extracting information on all nodes and edges that constitute the path, especially those quasi-identifier fields that serve as connection keys. For example, the analysis reveals that an out-of-threshold path is achieved by associating the mobile phone number field of the customer table in the CRM database with the contact phone number field of the recipient information table in the order database.

[0102] Next, the system constructs precise association severance instructions by concatenating a predefined quasi-identifier field with a unique data asset identifier. The rule format is ACTION:DATASOURCE_TYPE:DATABASE_NAME.SCHEMA_NAME.TABLE_NAME.COLUMN_NAME, where ACTION is fixed as CUT_LINK, DATASOURCE_TYPE specifies the data source type such as MySQL or HIVE, and the following is the fully qualified name of the field. For the example above, the system will generate an instruction such as CUT_LINK:MYSQL:orderdatabase.dbo.consigneeinformationtable.contactphone. This instruction means that in the subsequent query rewriting stage, direct access to or association with this field must be prevented. The system generates similar instructions for each critical connection edge in each threshold path and gathers all instructions into a list.

[0103] Finally, the system encapsulates the three pieces of information—the basic fuzziness level generated in the first step (e.g., "high-intensity fuzziness"), the newly generated list of associated cut-off instructions, and the complete set of over-threshold path markers—into a unified, structured policy object, forming dynamic data access control rules.

[0104] S4. Parse the operation items in the dynamic data access control rules, replace the selection columns and connection conditions in the electronic data access request, generate the de-identified and rewritten query instruction, submit the de-identified and rewritten query instruction to the data platform and execute it, and obtain the returned access-controlled de-identified dataset.

[0105] 1. The specific steps for generating the anonymized and rewritten query command are as follows:

[0106] Parse the operation item field in the dynamic data access control rule, read the replacement instruction and encapsulation instruction, and record the target selection column, connection condition and corresponding desensitization processing method for each replacement instruction and encapsulation instruction to form an operation item mapping list;

[0107] Based on the operation item mapping list, the selection columns and connection conditions are matched item by item in the electronic data access request. The matched selection columns are directly replaced with de-identified placeholders, and the matched connection conditions are embedded with de-identified function expressions to generate de-identified and rewritten query instructions.

[0108] Example 5:

[0109] The structured object of dynamic data access control rules generated in the preceding steps is parsed, and the basic fuzziness level, associated cutoff instructions, and over-threshold path marker set are extracted from it:

[0110] First, the system processes the replacement instructions corresponding to the basic blurring level. Based on the set text descriptions such as "high-intensity blurring" and "medium-intensity blurring", it queries a built-in desensitization function library. This function library maintains a mapping from descriptive levels to specific database functions. For example, "high-intensity blurring" maps to the MASK_ALL() function, and "medium-intensity blurring" maps to the MASK_PREFIX_SUFFIX(col,2,2) function. The system will determine the desensitization function to be applied to the sensitive selection columns of all non-associative conditions in the original query based on this mapping relationship and record it.

[0111] Next, the system begins processing the list of join-breaking instructions, reading one by one instructions in the form of CUT_LINK:MYSQL:orderdatabase.dbo.consigneeinformationtable.contactphone. These instructions are defined as encapsulation instructions, which the system parses as encapsulation operations on the target join conditions. Specifically, it encapsulates any equality comparison expressions in the JOINON or WHERE clauses of the original query involving the field "orderdatabase.dbo.consigneeinformationtable.contactphone" with an expression that is always false, such as 1=0, or a specific function that the database can recognize as a join-breaking function. The purpose of this encapsulation is to logically sever the join path without changing the SQL syntax structure. The system records each parsed target selection column or join condition, along with its corresponding specific desensitization processing method (replacing it with a function call or encapsulating it into a specific expression), as an entry, ultimately forming a clear list of operation items. This list is stored in key-value pairs, where the key is the string representation of the target column name or join condition expression in the original SQL, and the value is the target string to be replaced or encapsulated.

[0112] Based on the operation item mapping list generated in the previous step, the system initiates the process of rewriting the SQL statement in the original electronic data access request. The core of this process is precise node replacement using an Abstract Syntax Tree (AST). First, the system parses the original SQL query statement (e.g., SELECT c.name, o.order_id, r.phone FROM customer c JOIN "order" o ON c.id=o.customer_id JOIN receiver_infor ON o.receiver_id=r.id WHERE c.level='VIP') into an AST. Then, the system iterates through each entry in the operation item mapping list. For each entry, it searches the AST for a node matching the key. If the list contains an entry with the key {key:"r.phone",value:"MASK_ALL(r.phone)"}, this is a selection column replacement. The system finds the r.phone column reference node in the AST's SELECT clause list and directly replaces it with a function call node. The parameter is named MASK_ALL, and the parameter is the original r.phone node. If there is another entry in the list with {key:"o.receiver_id=r.id",value:"1=0"}, this belongs to the join condition encapsulation. The system finds the binary comparison expression node that completely matches o.receiver_id=r.id in the ON condition expression of the JOIN clause of the AST, and replaces it with a new constant expression node representing 1=0. This process will be performed item by item until all instructions in the list have been processed. After all replacement and encapsulation operations are completed, the system reserializes the modified AST to generate a new text string that conforms to SQL syntax. This string is the de-identified and rewritten query instruction. For example, the original query is rewritten as SELECT c.name,o.order_id,MASK_ALL(r.phone) FROM customer c JOIN "order" o ON c.id=o.customer_id JOIN receiver_in for ON 1=0 WHERE c.level='VIP'.

[0113] 2. The specific steps for obtaining the returned access-controlled de-identified dataset are as follows:

[0114] Based on the de-identified and rewritten query command, the query is submitted to the data platform and executed. After receiving the query results, the data source and processing level are labeled according to the de-identification strategy to form a returned access-controlled de-identified dataset.

[0115] Example 6:

[0116] Based on the anonymized and rewritten query command generated in the previous process, the system submits this command to the backend data platform for execution via standard database connection protocols (such as JDBC and ODBC). The data platform, such as a relational database management system (RDBMS) or a big data query engine (such as Presto or Hive), will parse, optimize, and ultimately execute this rewritten command, just like any normal SQL query. Since the query command itself is syntactically valid, the database will execute it successfully and return a result set. The system receives this result set returned by the data platform and... Instead of directly delivering it to the end user, the system performs a final metadata annotation process. Based on the information in the dynamic data access control rules, the system adds additional metadata information to the returned dataset. Specifically, the system adds a source label to each column of data in the result set, indicating which specific database, table, and field the data in that column originates from. At the same time, based on the desensitization strategy adopted (such as "high-intensity obfuscation" or "association severance"), a processing level label is assigned to each column or the entire dataset, such as "L4 - Highly Controlled". This metadata information is encapsulated together to form the final returned access-controlled desensitized dataset.

[0117] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0119] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for dynamic desensitization processing of electronic data, characterized in that, The method comprises: acquiring an electronic data access request and calculating a query intention convergence score based on the electronic data access request; reading a quasi-identifier to be queried from the electronic data access request, identifying and tracking associated paths connectable to external information sources in combination with a data asset association graph, calculating a connection success probability of each associated path, generating a high-risk information association path list, and acquiring an information arbitrage risk assessment value in combination with a preset sensitive information value; comparing the query intention convergence score with a preset score interval, selecting a corresponding basic fuzzification level, and simultaneously judging the information arbitrage risk assessment value against a preset risk threshold to establish a dynamic data access control rule; parsing operation items in the dynamic data access control rule, replacing selected columns and connection conditions in the electronic data access request, generating a query instruction after desensitization rewriting, submitting the query instruction after desensitization rewriting to a data platform and executing the query instruction, and acquiring a returned access-controlled desensitized data set; wherein the establishment of the dynamic data access control rule comprises the following steps: calling the query intention convergence score, comparing the query intention convergence score with the upper limit of each score interval in the boundary set of the score interval in the configuration table one by one, locking the mapping index of the score interval when the query intention convergence score is less than or equal to the upper limit of any score interval and greater than the upper limit of the previous score interval, and retrieving the corresponding entry in the fuzzification level mapping table by the mapping index to generate the basic fuzzification level; based on the basic fuzzification level, reading the risk threshold, comparing the information arbitrage risk assessment value with the risk threshold, and if the information arbitrage risk assessment value is greater than the risk threshold, sequentially traversing the high-risk information association path list and marking each associated path with a threshold-exceeding mark to generate a threshold-exceeding path mark set; based on the threshold-exceeding path mark set, parsing the quasi-identifier field in each threshold-exceeding path, constructing an association cutting instruction according to the quasi-identifier field and the data asset unique identifier splicing rule, encapsulating the basic fuzzification level, the association cutting instruction and the threshold-exceeding path mark set into a unified strategy structure, and forming the dynamic data access control rule.

2. The method of claim 1, wherein, The calculation of the query intention convergence score comprises the following steps: parsing the electronic data access request to acquire the number of filter fields, the number of logical operators, the frequency of aggregation function calls, the JOIN nesting level, the number of JOIN fields, the total number of target fields and the total number of filterable fields; calculating the filter field usage rate based on the number of filter fields and the total number of filterable fields, forming a normalized WHERE clause complexity index in combination with the number of logical operators, constructing a JOIN structure complexity by calling the JOIN nesting level and the number of JOIN fields, extracting the frequency of aggregation function calls as the aggregation usage intensity, and calculating the field selection ratio by extracting the total number of fields and the number of selected columns to generate the normalized WHERE clause complexity, the JOIN structure complexity, the aggregation usage intensity and the field selection ratio; calculating the query intention convergence score according to the normalized WHERE clause complexity, the JOIN structure complexity, the aggregation usage intensity and the field selection ratio.

3. The method of claim 1, wherein, The generating high-risk information association path list comprises the following specific steps: reading a quasi-identifier to be queried from an electronic data access request, and analyzing a field type pointed by the quasi-identifier to be queried based on a quasi-identifier set to be queried; traversing all connectable nodes in a data asset association graph, locating all complete association paths meeting a cross-source connection condition, and generating a high-risk information association path list by continuously operating in combination with a connection probability value corresponding to each edge in the association path.

4. The method of claim 1, wherein, The acquiring information arbitrage risk evaluation value comprises the following specific steps: extracting a field co-occurrence pair number, a cross-domain jump number, and a structure completeness degree level of an end entity in the association path, and a sensitive information value level corresponding to an association target of the association path, generating a connection success probability value, the field co-occurrence pair number, the cross-domain jump number, the structure completeness degree level, and the sensitive information value level of each association path, and generating a structure extraction result of each association path according to the high-risk information association path list. calculating the information arbitrage risk evaluation value according to the connection success probability value, the field co-occurrence pair number, the cross-domain jump number, the structure completeness degree level, and the sensitive information value level of each association path.

5. The method of claim 1, wherein, The generating a query instruction after desensitization rewriting comprises the following specific steps: analyzing an operation item field in the dynamic data access control rule, reading a replacement instruction and a packaging instruction, recording a target selection column, a connection condition, and a corresponding desensitization processing mode for each replacement instruction and packaging instruction, and forming an operation item mapping list; based on the operation item mapping list, matching the selection column and the connection condition in the electronic data access request item by item, directly replacing the matched selection column with a desensitization placeholder, and embedding a desensitization function expression outside the matched connection condition to generate a query instruction after desensitization rewriting.

6. The method of claim 1, wherein, The acquiring a returned access-controlled desensitized data set comprises the following specific steps: based on the query instruction after desensitization rewriting, submitting and executing a query to a data platform, marking a data source and a processing level according to a desensitization strategy after receiving a query result, and forming a returned access-controlled desensitized data set.

Images